Two insider threat mistakes security pros continue to make

When IT pros are planning cybersecurity strategies, they primarily focus on protecting their data from outside forces.

Unfortunately, insiders are often a forgotten, or minimized, threat. In an era dominated by headlines such as Dark Reading’s recent “US GOP Senate Committee allegedly target of Russian hackers,” it’s not uncommon for IT teams to believe external threats are their biggest concern. However, 67 percent of organizations have experienced data theft or corruption from people within their organization, according to a recent report. That statistic is only expected to increase (by 62 percent, to be exact) over the next year.

Recently, DataGravity held a Periscope webcast in honor of National Cyber Security Month. The theme of the week, “Security from the break room to the boardroom,” is a topic near and dear to co-founders Paula Long and John Joseph. In the segment, Paula and John discussed why all employees throughout an organization are responsible for cybersecurity. In addition to talking about how employees can promote better data security practices within their companies, Paula and John also addressed how to minimize the dangers users can incite when they’re not careful.

Insider threats should be on every organization’s radar in order to best defend sensitive data. Protecting the data from the inside out and decreasing the likelihood of an attack is simple – as long as they keep a couple of key things in mind.

No. 1: Focus on user behavior

The likelihood that someone within a company will attempt to steal information is often misjudged as a rare occurrence. As a result, businesses primarily focus on prevention methods like malware detection and beefing up firewalls.

However, new technologies that can help block viruses aren’t always enough. Employees have access to millions of files that could put their company, coworkers and customers at risk, whether they harbor malicious intent or not. Organizations must be able to recognize anomalous user activity, such as files being moved or employees accessing information they don’t need to complete their jobs. Failing to track user behavior poses a major problem for companies, putting them at a real disadvantage when it comes to threat detection.

No. 2: Know what lives in the data

“Data is the new bacon,” as Paula puts it. Everyone wants it, but most people don’t even know what’s in it. To best protect intellectual property and other sensitive information, businesses must understand what kind of information is hidden inside their data. Taking a proactive approach and being data aware helped one company uncover 40,000 files that contained credit card and Social Security numbers – and the IT team was completely unaware such files existed. To protect themselves against threats, organizations must make sure they’re addressing the 5 W’s of data security: who, what, where, when and why data is being used.

While it’s impossible to predict the cause of a next cyberattack, there are steps businesses can take to better defend themselves. Sharing security tips with staff members and educating the IT team about the ever-growing threat employees pose is just the first step.

Are insider threats putting your data at risk? Find out with a free security assessment.

  Like This
Cheryle Cushion

Cheryle Cushion

Cheryle has more than 20 years of experience in developing corporate marketing strategies and executing integrated marketing programs that drive strong customer engagement via direct and indirect sales channels. She has held various marketing leadership roles in several successful companies including Infinio Systems, Raptor Systems, Interliant, Seahorse BioScience, Dell and most notably EqualLogic which was purchased by Dell in 2008 for $1.4B.